Inspect dependency manifests for missing versions, risky install scripts, unknown licenses, and policy issues without claiming to replace a live CVE database.